Weaknesses of type CWE-434

3,091 results

Upload sem restrição de arquivo com tipo perigoso

Ocorre quando uma aplicação aceita upload de arquivos sem validar adequadamente seu tipo, extensão ou conteúdo. Um atacante pode enviar executáveis, scripts ou outros arquivos maliciosos, que serão armazenados ou executados no servidor, comprometendo sua integridade e segurança.

Example

Um formulário de perfil aceita qualquer arquivo como 'foto do usuário' sem checar extensão ou MIME type. Um atacante envia um arquivo .exe ou .php renomeado como .jpg, que é salvo no diretório web e posteriormente executado quando acessado, permitindo execução de código remoto.

How to mitigate

Valide uploads checando MIME type real (não apenas extensão), restrinja tipos permitidos de forma explícita, armazene arquivos fora da raiz web, desabilite execução de scripts no diretório de upload e considere usar vírus scanner. Implemente whitelist rigorosa, nunca blacklist.

CVE-2023-22450HIGH In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to upload an AEPSS 0.8%CVE-2024-13091CRITICALWPBot Pro Wordpress Chatbot <= 13.5.4 - Unauthenticated Arbitrary File UploadEPSS 0.8%CVE-2026-7490HIGHSunnet｜CTMS and CPAS - Arbitrary File UploadEPSS 0.8%CVE-2024-12233MEDIUMcode-projects Online Notice Board Profile Picture registration.php unrestricted uploadEPSS 0.8%CVE-2024-4920MEDIUMSourceCodester Online Discussion Forum Site registerH.php unrestricted uploadEPSS 0.8%CVE-2022-2749MEDIUMSourceCodester Gym Management System unrestricted uploadEPSS 0.8%CVE-2023-30266HIGHCLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type.EPSS 0.8%CVE-2022-46839CRITICALWordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Arbitrary File UploadEPSS 0.8%CVE-2024-42563CRITICALAn arbitrary file upload vulnerability in ERP commit 44bd04 allows attackers to execute arbitrary code via uploading a crafted HTML file.EPSS 0.8%CVE-2011-10041CRITICALUploadify <= 1.0 Unauthenticated Arbitrary File UploadEPSS 0.8%CVE-2023-39377HIGH SiberianCMS - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified methodEPSS 0.8%CVE-2024-34440CRITICALWordPress AI Engine plugin <= 2.2.63 - Auth. Arbitrary File Upload vulnerabilityEPSS 0.8%CVE-2025-6002HIGHVirtueMart - Unrestricted File UploadEPSS 0.8%CVE-2024-2754MEDIUMSourceCodester Complete E-Commerce Site users_photo.php unrestricted uploadEPSS 0.8%CVE-2024-29859CRITICALIn MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.EPSS 0.8%CVE-2023-5277MEDIUMSourceCodester Engineers Online Portal student_avatar.php unrestricted uploadEPSS 0.8%CVE-2022-43979MEDIUMPath Traversal leading to Local File InclusionEPSS 0.8%CVE-2023-29375CRITICALAn issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, aEPSS 0.8%CVE-2020-37090HIGHSchool ERP Pro 1.0 - Remote Code ExecutionEPSS 0.8%CVE-2026-80233HIGHCAYIN Technology｜CAYIN CMS-WS/CMS-SE/SMP - Arbitrary File UploadEPSS 0.8%